Covid-19 local outbreak control plan privacy notice

As part of the Council’s response to the COVID-19 pandemic, Waltham Forest has developed a Local Outbreak Control Plan. The plan outlines how we aim to prevent the spread of the virus whilst also planning for the possibility of future waves and continuing to protect our community’s health, lives and freedoms should one occur.

Working with partners at the national and regional level, the role of the Council is to put in place measures to prevent, identify and contain local outbreaks. We do this by developing and delivering a Local Outbreak Control Plan which will reduce the spread of the virus in the borough. We will continue to provide support for the most vulnerable and those who need to self isolate. We will use our knowledge of the local area to deliver localised communications and engagement with our residents.

This Privacy Notice describes how the Council may use data, including some individual level data, in order to deliver and monitor the effectiveness of the Local Outbreak Control Plan. This includes using personal data for the purpose of local contact tracing and undertaking ‘welfare checks’ with individuals who have tested positive for COVID-19 or have been identified as a recent contact of those individuals.

The Council has also published a general COVID-19 Privacy Notice.

Data about individuals who have had a COVID-19 test, and their recent contacts, is shared with the Local Authority under a specific Data Sharing Agreement designed by Public Health England. Although this data is shared from Public Health England, Waltham Forest Council holds the data as an independent Data Controller.

This data includes personal details of people who have had a COVID-19 test through NHS Test & Trace. For people whose test result is positive, the data also includes personal details for contacts of the test subject, as identified by the test subject to the NHS Test and Trace programme.

Data about individuals who have booked to have a vaccination in one of the Council’s clinics across the borough is shared with Council staff. This is for the purpose of booking a time slot for their vaccination, verifying identity on arrival for vaccination, and maintaining a record of consent. We will also collect anonymised data for statistical purposes

The personal data shared with Local Authorities includes:

• full name
• date of birth
• sex/gender
• ethnic group
• NHS number
• home postcode and house number
• mobile phone number
• telephone number
• email address

Further information is provided in the NHS Test and Trace Privacy Notice published by Public Health England.

Access to accurate, timely and actionable data is essential to identifying and responding effectively to outbreaks of COVID-19 in Waltham Forest. A range of datasets, some including individual-level data, are shared with us for this purpose by Public Health England, the London Coronavirus Response Centre, the Office of National Statistics and other bodies.

Most of these datasets are in the form of aggregated statistics that do not include any personal data. This includes daily summary reports for the NHS Test and Trace programme, Public Health England Daily Surveillance, London Coronavirus Response Centre Daily Summary, and daily death registrations statistics.

Processing of some individual-level data (as described above) is also necessary for:

• in-depth understanding and operational responses to local outbreaks
• to undertake contact tracing in support of NHS Test and Trace
• to support individuals who may directly request help from the local authority
• provide a rapid testing programme using Lateral Flow Tests in various settings across the Council

The ‘COVID-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ confirms specific purposes for which individual-level data may be shared with local authorities, including:

• understanding COVID-19 and risks to public health, trends in COVID-19 and controlling and preventing the spread of COVID-19
• processing to support NHS Test and Trace
• identifying and understanding information about patients or potential patients with or at risk of COVID-19. This includes information about incidents of patient exposure to COVID-19 and the management of patients with or at risk of COVID-19. This ranges from and includes; locating, contacting, screening, flagging and monitoring such patients. This also includes collecting information about and providing services in relation to testing, diagnosis, self isolation, fitness to work, treatment, medical and social interventions and recovery from COVID-19
• understanding information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of COVID-19 and the availability and capacity of those services or that care
• monitoring and managing the response to COVID-19 by health and social care bodies and the government. This is achieved by providing information to the public about COVID-19 and its effectiveness. This also includes information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services
• delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with COVID-19. This includes the provision of information, fit notes and the provision of health care and adult social care services
• research and planning in relation to COVID-19

Where possible, datasets that do not contain any individual-level details will be used to deliver and evaluate the Local Outbreak Control Plan. Unless it is essential for the purpose of responding to a specific local outbreak or undertaking local contact tracing and welfare checks, individual-level data will be anonymised before further processing.

The legal bases for the processing of personal data described in this Privacy Notice are:

• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (GDPR Article 6.1 (e))
• processing is necessary for reasons of public interest in the area of public health. This refers to protecting against serious cross border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices. This is on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy (GDPR Article 9.2 (i)).
• Data Protection Act 2018 Schedule 1 Part 1 (3) - public health
• COPI Notice: COVID-19 Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002
• Consent is the lawful basis that will be relied upon for vaccination bookings and for issuing reminders to book a second vaccination when it becomes due

It may be necessary to seek and obtain additional contact details for an individual from other local authority database systems. This could be for the purpose of contact tracing. The relevant details may be entered in the NTAT/CTAS contact tracing database system, managed by NHS Test and Trace. The personal data described in this Privacy Notice will not be shared with any other organisations except NHS Test and Trace. In the case of a vaccination appointment, the data will be shared with clinicians administering the vaccine.

Within the Council, it will only be available to:

• Staff within the Council’s Public Health service who are directly involved in delivering the Local Outbreak Control Plan
• Relevant data analysts who are supporting the monitoring and evaluation of the Local Outbreak Control Plan
• Staff directly involved in local contact tracing, welfare checks or Lateral Flow testing sites
• Staff directly involved in arranging and providing support that has been requested by an individual, through a welfare check

In the usual way, personal data will never be disclosed in response to a Freedom of Information request.

Personal data shared with the local authority by Public Health England for confirmed COVID-19 infections will only be held for the period specified in the Data Sharing Agreement with Public Health England. This can be found under: ‘COVID-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ from the Secretary of State for Health and Social Care to Local Authorities in England.

Other personal data will only be kept for as long as is necessary for the purpose for which the Council is processing it unless there is a legitimate reason for keeping it longer. At present, it is not known how long data relating to the management of the COVID-19 pandemic will be retained. You can be assured that the Council will follow any published guidance in this respect as and when it becomes available.

Vaccination Bookings at Waltham Forest pop-up clinics: data will be kept until your vaccination booking is complete for the second vaccination. Or, until a reminder is issued to you regarding your second vaccination where you have provided an email address for this purpose.